aarifmms/keyblind

**Encrypted secrets vault with MCP for AI agents. Secrets resolved at runtime, never leaked to LLM conversations.**
Why
Developers regularly leak API keys, passwords, and tokens to AI coding tools. 100,000+ LLM conversations with exposed secrets were found indexed by search engines in 2025.
AI agents read your .env files. They copy-paste secrets into conversations. They commit them accidentally. Keyblind stops this by keeping secrets encrypted at rest and resolving them _at runtime_ — the plaintext value never touches the LLM transcript.
How It Works
Quick Start
> **That's it.** After keyblind setup-mcp, restart Claude Code. Then just say _"list my keyblind secrets"_ or _"use my OPENAI_API_KEY"_ — the AI agent resolves secrets at runtime without ever seeing them in the transcript.
MCP Server
Keyblind is **MCP-first** — it works with every AI tool that speaks the Model Context Protocol (Claude Code, Cursor, Copilot, Windsurf, Cline, Zed).
Setup (automatic)
This auto-configures Claude Code to use Keyblind. Works from any directory. For other editors, see editor-specific configs.
Setup (manual)
Add a .mcp.json to your project root, or use claude mcp add:
With biometric gate (Touch ID required before secrets are resolved):
> Session expires after 15 minutes. Requires Pro or Team license.
MCP Tools
| Tool | Description |
|------|-------------|
| resolve_secret | Resolve a secret at runtime (value hidden from transcript) |
| store_secret | Encrypt and store a secret |
| list_secrets | List secret names (values never revealed) |
| delete_secret | Delete a secret |
| sandbox_env | Replace .env values with deterministic fakes |
| unsandbox_env | Restore real .env values from vault |
| audit_log | View secret resolution audit trail |
| totp_code | Generate a TOTP 2FA code for a stored config |
| totp_store | Store a TOTP configuration from otpauth:// URI |
| totp_list | List all stored TOTP configurations |
| totp_delete | Delete a TOTP configuration |
| create_share_link | Create encrypted, expiring share link for a secret |
| receive_share | Receive and decrypt a shared secret |
| deadman_status | Check dead man's switch status |
| deadman_checkin | Reset dead man's switch timer |
| sso_status | Check SSO/OIDC authentication status |
Web Dashboard
Manage your secrets from a browser at **app.keyblind.dev**. Start the HTTP server:
Then sign in with your license key at app.keyblind.dev/login. Features:
- View, add, copy, and delete secrets
- Audit log with full access history
- License management
- Pro/Team tier status
Browser Extension
The **Keyblind Chrome Extension** detects and blocks secrets from being pasted into AI chat interfaces (Claude.ai, ChatGPT, Copilot).
Features:
- Detects 12+ API key formats (OpenAI, GitHub, Stripe, AWS, etc.)
- Intercepts paste events on AI chat sites
- Warning banner when secrets are detected
- Popup with vault connection status
Located in browser-extension/. Load as unpacked extension from chrome://extensions.
Pricing
| | Free | Pro | Team |
|------|------|-----|------|
| **Price** | $0 | $79/year | $29/user/month |